tsvetelinaruskova.com · Last updated 25 October 2026 · Replaces the policy of March 2026
This policy explains how personal data is collected and used when you visit tsvetelinaruskova.com, contact us, book a call, buy something, or work with us as a client.
Data controller: 22 Degrees Ltd., EIK 208956479
Registered seat: 14 Antim I Street, floor 2, office, 1303 Sofia, Bulgaria
Contact for privacy: email@tsveteempower.me
Represented by: Tsvetelina Ruskova, manager
The Company has not appointed a Data Protection Officer, because the processing it carries out does not meet the conditions that make one mandatory. Privacy questions go directly to the address above and are handled by Tsvetelina Ruskova.
Where this policy says "we", "us" or "the Company", it means 22 Degrees Ltd. It does not mean you personally, and it does not mean any third-party service named in section 7.
| Category | What it includes | Where it comes from |
|---|---|---|
| Identity & contact | Name, email address, phone number if you give one, country, preferred language, time zone | Contact form, Calendly booking, Payhip checkout, email |
| Enquiry content | The message you write, and anything you choose to tell us about your situation | Contact form, email, discovery call notes |
| Client records | Programme agreed, session dates, session notes written by the coach, agreed goals, progress notes, exercises assigned | Created during the engagement |
| Transaction data | What you bought, amount, currency, date, invoice details, company name and VAT number if you buy as a business | Payhip, bank records |
| Payment data | Card payments are processed by the payment provider. We receive confirmation of payment and the last digits of the card, never the full card number | Payhip and its payment processors |
| Technical data | IP address, device and browser type, pages viewed, approximate location derived from IP, referring source | Google Analytics 4, Google Tag Manager, server logs |
| Recordings & session data | Anything you send us (documents, voice notes) and any recording made with your separate consent | You, or the session itself |
| Marketing preferences | Whether you have subscribed to the newsletter, and your engagement with emails | Email platform, your own actions |
Coaching conversations can drift into health, emotional wellbeing, relationships, beliefs or sexuality. Information of that kind is "special category" data under Article 9 GDPR and gets stronger protection.
We do not ask for it, and we do not need it. If you choose to share it, we will treat it as confidential and process it only on the basis of your explicit consent (Article 9(2)(a) GDPR), for the purpose of delivering the coaching you have asked for. You can decline to answer any question, and you can withdraw that consent at any time — though withdrawing it may limit what the coaching can address.
We never ask for medical records, and we do not want them. Please do not send diagnostic reports, test results or clinical documents.
| Purpose | Legal basis (GDPR Art. 6) | Notes |
|---|---|---|
| Answering your enquiry and arranging a discovery call | Legitimate interests (1)(f); consent (1)(a) where you submit a form | Our interest is in responding to people who contact us. We keep enquiry data for 12 months. |
| Delivering coaching, programmes, events and workshops | Performance of a contract (1)(b) | Includes scheduling, session notes, and communicating about your programme. |
| Delivering digital products you have bought | Performance of a contract (1)(b) | Access links and delivery records. |
| Invoicing, accounting and tax records | Legal obligation (1)(c) | Bulgarian accounting and tax law sets the retention period. |
| Handling complaints, refunds and disputes | Legal obligation (1)(c); legitimate interests (1)(f) | Including defending or bringing legal claims. |
| Analytics and site improvement | Consent (1)(a) | Google Analytics 4 and Microsoft Clarity are set to load only after you consent. See section 8. |
| Newsletter and updates | Consent (1)(a), or soft opt-in where permitted | Unsubscribe link in every email. Unsubscribing does not affect anything you have bought. |
| Protecting the service from abuse, and keeping it secure | Legitimate interests (1)(f) | Rate limiting, spam filtering, security logs. |
We do not use your data for automated decision-making, we do not build profiles for advertising, and we do not sell or rent personal data to anyone.
Access is limited to Tsvetelina Ruskova, and to the service providers below where necessary. Each is bound by a data processing agreement or equivalent terms, and each is used only for the purpose listed.
| Provider | Purpose | Location / safeguard |
|---|---|---|
| SiteJet by Hostinger | Website platform and hosting; contact form delivery | EU / EEA; processed within the EU |
| Namecheap, Inc. | Domain registration and DNS | USA; EU Standard Contractual Clauses |
| Calendly LLC | Booking and managing discovery calls and sessions | USA; EU Standard Contractual Clauses |
| Payhip Ltd. | Checkout, payment and delivery of digital products; collection and remittance of EU and UK VAT on digital sales, where applicable | United Kingdom; UK adequacy decision and SCCs |
| Google Ireland Ltd. / Google LLC | Google Analytics 4, Google Tag Manager, Google Search Console | Ireland / USA; EU–US Data Privacy Framework and SCCs |
| Microsoft Ireland Operations Ltd. | Microsoft Clarity — anonymised session recordings and heatmaps | Ireland / USA; EU–US Data Privacy Framework |
| MailerLite | Sending transactional email and the newsletter | EU / EEA, or SCCs where outside |
| Schetito.bg | Statutory accounting and tax filing | Bulgaria; professional confidentiality obligation |
| Professional adviser | Legal advice, insurance, professional supervision | Bulgaria / EU; professional confidentiality obligation |
We may also disclose data where the law requires it, where a competent authority lawfully requests it, or to establish or defend a legal claim. If the business is ever sold or transferred, client data may transfer with it; you will be told before that happens and the new controller's identity published here.
Some providers are outside the European Economic Area, mainly in the United States and the United Kingdom. Where data leaves the EEA, we rely on an adequacy decision (the UK, and the EU–US Data Privacy Framework where the provider is certified), or on the European Commission's Standard Contractual Clauses together with the supplementary measures the provider has adopted.
You can ask for a copy of the relevant safeguard by writing to the contact address in section 1.
| What | How long |
|---|---|
| Enquiries that do not become an engagement | 12 months from last contact, then deleted |
| Discovery call notes where no engagement follows | 6 months from the call, then deleted |
| Client session notes and programme records | 3 years from the end of the engagement, then deleted — this is a professional accountability period, so that a former client's process can be recalled accurately if they return or raise a concern |
| Contracts, invoices and accounting records | As required by Bulgarian accounting and tax law (currently 10 years for accounting records) |
| Newsletter subscription | Until you unsubscribe, plus a short suppression record so we do not email you again by mistake |
| Analytics data | 14 months in Google Analytics 4; Clarity recordings 30 days by default |
| Complaint files | Until the matter is closed, then as long as needed for limitation periods |
Cookies are small files stored by your browser. Some are necessary for the site to work; others are optional and are only set with your consent.
| Cookie | Set by | Purpose | Type & duration |
|---|---|---|---|
| Session and security cookies | SiteJet / host | Load balancing, form protection, keeping the site working | Strictly necessary · session |
| __cf_bm | Cloudflare, via Calendly | Bot detection on the booking widget | Strictly necessary · 30 minutes |
| _calendly_session | Calendly | Remembers a booking in progress | Functionality · session |
| _ga, _ga_* | Google Analytics 4 | Measures visits and page use in aggregate | Analytics · up to 2 years |
| _clck, _clsk | Microsoft Clarity | Anonymised heatmaps and session replays, to find usability problems | Analytics · 1 day to 1 year |
You have the right to:
Access — get a copy of the personal data we hold about you.
Rectification — have inaccurate or incomplete data corrected.
Erasure — have your data deleted, where no legal obligation requires us to keep it.
Restriction — limit how we use it while a question about it is being resolved.
Objection — object to processing based on legitimate interests, including any direct marketing.
Portability — receive the data you gave us in a structured, machine-readable format.
Withdraw consent — at any time, without affecting what was lawfully done before.
Not be subject to automated decisions with legal effect — we do not make any.
Write to email@tsveteempower.me. We respond within one month, and will tell you if a complex request needs longer. There is no fee. We may ask you to confirm your identity before acting, so that we do not disclose data to the wrong person.
Some rights are limited in practice: if you ask us to delete session notes while a complaint or legal claim is open, we may need to keep them until that is resolved, and accounting records cannot be deleted before their statutory retention period ends.
We use HTTPS across the site, access controls on accounts holding client data, unique passwords with two-factor authentication where available, and keep the number of people with access to client records as small as possible. Session notes are stored in access-controlled systems, not in public folders.
No system is perfectly secure. If a breach ever occurs that is likely to create a high risk to your rights, we will notify you and the Bulgarian supervisory authority as required by Articles 33 and 34 GDPR.
The services are for adults. The site is not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has submitted data, write to us and we will delete it promptly.
If you think we have handled your data badly, tell us first — most issues are resolved that way. You also have the right to complain to the Bulgarian supervisory authority:
| Authority | Commission for Personal Data Protection |
| Address | 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria |
| Email / web | kzld@cpdp.bg · cpdp.bg |
You may also complain to the supervisory authority in the EU country where you live or work.
This policy is reviewed when the services, the tools we use, or the law change. The date at the top of the page shows the current version. Where a change materially affects you, we will tell you by email before it takes effect.
22 Degrees Ltd.
14 Antim I Street, floor 2, office, 1303 Sofia, Bulgaria
Email: email@tsveteempower.me
22 Degrees Ltd. · Privacy Policy · Version 1.0, 2026
